hal-disable-polling crash: buffer overflow detected

Bug #530569 reported by Daniel J Blueman
388
This bug affects 96 people
Affects Status Importance Assigned to Milestone
hal (Ubuntu)
Invalid
Medium
Unassigned
Nominated for Lucid by jesus

Bug Description

Binary package hint: hal

When running 'hal-disable-polling /dev/cdrom', we see glibc detecting memory corruption and killing the process.

$ ls -l /dev/cdrom
lrwxrwxrwx 1 root root 3 2010-03-02 09:14 /dev/cdrom -> sr0

OS is a clean Intrepid alpha 3 install, updated.

ProblemType: Crash
Architecture: amd64
AssertionMessage: *** buffer overflow detected ***: hal-disable-polling terminated
Date: Tue Mar 2 09:46:18 2010
DistroRelease: Ubuntu 10.04
ExecutablePath: /usr/bin/hal-disable-polling
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Alpha amd64 (20100224.1)
Package: hal 0.5.14-0ubuntu3
ProcCmdline: hal-disable-polling --device /dev/cdrom
ProcEnviron:
 SHELL=/bin/bash
 PATH=(custom, no user)
 LANG=en_GB.utf8
ProcVersionSignature: Ubuntu 2.6.32-14.20-generic
Signal: 6
SourcePackage: hal
StacktraceTop:
 *__GI_raise (sig=<value optimised out>)
 *__GI_abort () at abort.c:92
 __libc_message (do_abort=<value optimised out>,
 *__GI___fortify_fail (
 *__GI___chk_fail () at chk_fail.c:29
Title: hal-disable-polling assert failure: *** buffer overflow detected ***: hal-disable-polling terminated
Uname: Linux 2.6.32-14-generic x86_64
UserGroups:

Revision history for this message
Daniel J Blueman (danielblueman) wrote :
Revision history for this message
Apport retracing service (apport) wrote :

StacktraceTop:
 *__GI_raise (sig=<value optimized out>)
 *__GI_abort () at abort.c:92
 __libc_message (do_abort=<value optimized out>,
 *__GI___fortify_fail (
 *__GI___chk_fail () at chk_fail.c:29

Revision history for this message
Apport retracing service (apport) wrote : Stacktrace.txt
Revision history for this message
Apport retracing service (apport) wrote : ThreadStacktrace.txt
Changed in hal (Ubuntu):
importance: Undecided → Medium
tags: removed: need-amd64-retrace
Revision history for this message
Daniel J Blueman (danielblueman) wrote :

This occurred on a clean install of 10.04 LTS beta 2.

visibility: private → public
Revision history for this message
Daniel J Blueman (danielblueman) wrote :
Download full text (3.1 KiB)

Debugging this, we see the addresses of the source ad destination path buffers passed gets trashed, here 0x62cc:

Program received signal SIGABRT, Aborted.
0x00007ffff7144a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
 in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) where
#0 0x00007ffff7144a75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff71485c0 in *__GI_abort () at abort.c:92
#2 0x00007ffff717e4fb in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>)
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3 0x00007ffff72101e7 in *__GI___fortify_fail (msg=0x7ffff725880d "buffer overflow detected") at fortify_fail.c:32
#4 0x00007ffff720f0a0 in *__GI___chk_fail () at chk_fail.c:29
#5 0x00007ffff720f6fb in __realpath_chk (buf=0x62cc <Address 0x62cc out of bounds>,
    resolved=0x62cc <Address 0x62cc out of bounds>, resolvedlen=6) at realpath_chk.c:30
#6 0x0000000000401687 in realpath (argc=<value optimized out>, argv=<value optimized out>) at /usr/include/bits/stdlib.h:46
#7 main (argc=<value optimized out>, argv=<value optimized out>) at hal-disable-polling.c:194

Further more, building with optimisation disabled, the crash is not experienced:

$ apt-get source hal
$ cd hal-*
$ debuild -rfakeroot -us -uc
$ cd tools

$ gcc -DHAVE_CONFIG_H -I. -I.. -DPACKAGE_LIBEXEC_DIR=\""/usr/lib/hal"\" -DPACKAGE_SYSCONF_DIR=\""/etc"\" -DPACKAGE_DATA_DIR=\""/usr/share"\" -DPACKAGE_BIN_DIR=\""/usr/bin"\" -DPACKAGE_LOCALSTATEDIR=\""/var"\" -DPACKAGE_SCRIPT_DIR=\""/usr/lib/hal/scripts"\" -DPACKAGE_LOCALE_DIR=\""/usr/share/locale"\" -I.. -I../libhal -I../libhal-storage -I/usr/include/dbus-1.0 -I/usr/lib/dbus-1.0/include -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/dbus-1.0 -I/usr/lib/dbus-1.0/include -c hal-disable-polling.c -O0
$ gcc -Wl,--as-needed -Wl,-Bsymbolic-functions -o hal-disable-polling hal-disable-polling.o -pthread -L/lib -ldbus-glib-1 /usr/lib/libgobject-2.0.so /usr/lib/libgthread-2.0.so /usr/lib/libglib-2.0.so -ldbus-1 -lpthread -lrt ../libhal/.libs/libhal.so -pthread
$ sudo ./hal-disable-polling --device /dev/foo
Cannot find device /dev/foo.

$ gcc -DHAVE_CONFIG_H -I. -I.. -DPACKAGE_LIBEXEC_DIR=\""/usr/lib/hal"\" -DPACKAGE_SYSCONF_DIR=\""/etc"\" -DPACKAGE_DATA_DIR=\""/usr/share"\" -DPACKAGE_BIN_DIR=\""/usr/bin"\" -DPACKAGE_LOCALSTATEDIR=\""/var"\" -DPACKAGE_SCRIPT_DIR=\""/usr/lib/hal/scripts"\" -DPACKAGE_LOCALE_DIR=\""/usr/share/locale"\" -I.. -I../libhal -I../libhal-storage -I/usr/include/dbus-1.0 -I/usr/lib/dbus-1.0/include -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/dbus-1.0 -I/usr/lib/dbus-1.0/include -c hal-disable-polling.c -O1
$ gcc -Wl,--as-needed -Wl,-Bsymbolic-functions -o hal-disable-polling hal-disable-polling.o -pthread -L/lib -ldbus-glib-1 /usr/lib/libgobject-2.0.so /usr/lib/libgthread-2.0.so /usr/lib/libglib-2.0.so -ldbus-1 -lpthread -lrt ../libhal/.libs/libhal.so -pthread
$ sudo ./hal-disable-polling --device /dev/foo
*** buffer overflow detected ***: ./hal-disab...

Read more...

Revision history for this message
Daniel J Blueman (danielblueman) wrote :

I've attached a patch to workaround the issue by allowing realpath() to internally allocate the memory from the heap, which we free later.

tags: added: i386
Revision history for this message
jesus (ivo-vavrik) wrote :
Download full text (3.3 KiB)

also afects my notebook msi GX630
hal eats more battery when the cdrom polling is enabled(for my notebook it is -20 minutes), i didnt find a way to stop it, when i try

sudo hal-disable-polling --device /dev/cdrom
*** buffer overflow detected ***: hal-disable-polling terminated
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x50)[0xb767d350]
/lib/tls/i686/cmov/libc.so.6(+0xe128a)[0xb767c28a]
/lib/tls/i686/cmov/libc.so.6(+0xe19a8)[0xb767c9a8]
hal-disable-polling[0x80492bf]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb75b1bd6]
hal-disable-polling[0x8048c01]
======= Memory map: ========
08048000-0804a000 r-xp 00000000 08:03 785731 /usr/bin/hal-disable-polling
0804a000-0804b000 r--p 00001000 08:03 785731 /usr/bin/hal-disable-polling
0804b000-0804c000 rw-p 00002000 08:03 785731 /usr/bin/hal-disable-polling
08c31000-08c52000 rw-p 00000000 00:00 0 [heap]
b7540000-b755d000 r-xp 00000000 08:03 130900 /lib/libgcc_s.so.1
b755d000-b755e000 r--p 0001c000 08:03 130900 /lib/libgcc_s.so.1
b755e000-b755f000 rw-p 0001d000 08:03 130900 /lib/libgcc_s.so.1
b755f000-b7561000 rw-p 00000000 00:00 0
b7561000-b7568000 r-xp 00000000 08:03 135268 /lib/tls/i686/cmov/librt-2.11.1.so
b7568000-b7569000 r--p 00006000 08:03 135268 /lib/tls/i686/cmov/librt-2.11.1.so
b7569000-b756a000 rw-p 00007000 08:03 135268 /lib/tls/i686/cmov/librt-2.11.1.so
b756a000-b7599000 r-xp 00000000 08:03 130958 /lib/libpcre.so.3.12.1
b7599000-b759a000 r--p 0002e000 08:03 130958 /lib/libpcre.so.3.12.1
b759a000-b759b000 rw-p 0002f000 08:03 130958 /lib/libpcre.so.3.12.1
b759b000-b76ee000 r-xp 00000000 08:03 135238 /lib/tls/i686/cmov/libc-2.11.1.so
b76ee000-b76ef000 ---p 00153000 08:03 135238 /lib/tls/i686/cmov/libc-2.11.1.so
b76ef000-b76f1000 r--p 00153000 08:03 135238 /lib/tls/i686/cmov/libc-2.11.1.so
b76f1000-b76f2000 rw-p 00155000 08:03 135238 /lib/tls/i686/cmov/libc-2.11.1.so
b76f2000-b76f5000 rw-p 00000000 00:00 0
b76f5000-b770a000 r-xp 00000000 08:03 135264 /lib/tls/i686/cmov/libpthread-2.11.1.so
b770a000-b770b000 r--p 00014000 08:03 135264 /lib/tls/i686/cmov/libpthread-2.11.1.so
b770b000-b770c000 rw-p 00015000 08:03 135264 /lib/tls/i686/cmov/libpthread-2.11.1.so
b770c000-b770e000 rw-p 00000000 00:00 0
b770e000-b771e000 r-xp 00000000 08:03 788570 /usr/lib/libhal.so.1.0.0
b771e000-b771f000 r--p 0000f000 08:03 788570 /usr/lib/libhal.so.1.0.0
b771f000-b7720000 rw-p 00010000 08:03 788570 /usr/lib/libhal.so.1.0.0
b7720000-b7721000 rw-p 00000000 00:00 0
b7721000-b7758000 r-xp 00000000 08:03 130878 /lib/libdbus-1.so.3.4.0
b7758000-b7759000 r--p 00036000 08:03 130878 /lib/libdbus-1.so.3.4.0
b7759000-b775a000 rw-p 00037000 08:03 130878 /lib/libdbus-1.so.3.4.0
b775a000-b7822000 r-xp 00000000 08:03 130904 /lib/libglib-2.0.so.0.2400.0
b7822000-b7823000 r--p 000c7000 08:03 130904 /lib/libglib-2.0.so.0.2400.0
b7823000-b7824000 rw-p 000c8000 08:03 130904 /lib/libglib-2.0.so.0.2400.0
b7834000-b7836000 rw-p 00000000 00:00 0
b7836000-b7837000 r-xp 00000000 00:00 0 [vdso]
b7837000-b7852000 r-xp 00000000 08:03 130842 /lib/ld-2.11.1.so
b7852000...

Read more...

Revision history for this message
aanno (thomas-pasch) wrote :

This also happens on lucid/10.04 64-bit (amd64).

Revision history for this message
Jörn-Ingo Weigert (magicman) wrote :

this also happend on natty narwhal alpha3 ...

Revision history for this message
Ulrich Schwab (ulrich-schwab) wrote :

same here on natty alpha 3 with all updates as of 2011-03-29

Changed in hal (Ubuntu):
status: New → Confirmed
Revision history for this message
kreyzoll (kreyzoll) wrote :

11.04 beta still

Revision history for this message
Mrth (mrth) wrote :

Also affecting 11.04 beta , upgraded from 10.10.
Can they release fixes for this.

Revision history for this message
wateenellende (fpbeekhof) wrote :

Just installed natty:

Setting up laptop-mode-tools (1.57-1ubuntu1) ...
 * Enabling laptop mode... *** buffer overflow detected ***: hal-disable-polling terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7fdcdfb8f1d7]
/lib/x86_64-linux-gnu/libc.so.6(+0xfd0f0)[0x7fdcdfb8e0f0]
/lib/x86_64-linux-gnu/libc.so.6(+0xfd70b)[0x7fdcdfb8e70b]
hal-disable-polling[0x401579]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xff)[0x7fdcdfaafeff]
hal-disable-polling[0x400f29]
======= Memory map: ========
00400000-00403000 r-xp 00000000 08:71 557420 /usr/bin/hal-disable-polling
00602000-00603000 r--p 00002000 08:71 557420 /usr/bin/hal-disable-polling
00603000-00604000 rw-p 00003000 08:71 557420 /usr/bin/hal-disable-polling
02397000-023b8000 rw-p 00000000 00:00 0 [heap]

$ dpkg -s hal
Package: hal
Status: install ok installed
Priority: optional
Section: admin
Installed-Size: 1764
Maintainer: Ubuntu Developers <email address hidden>
Architecture: amd64
Version: 0.5.14-5+svn1

Revision history for this message
Herczeg Zsolt (herczegzsolt) wrote :

I have the same problem. If you need debug information let me know.

Revision history for this message
userdce (userdce) wrote :

happening in Oneiric also

Revision history for this message
Coline OS (colineos) wrote :

Confirm, Oneiric beta2 has this bug too

Revision history for this message
pixeldoc (pixeldoc) wrote :

Also affecting 12.04 precise.

$ hal-disable-polling --device /dev/scd0
*** buffer overflow detected ***: hal-disable-polling terminated
...

$ dpkg -s hal
Package: hal
Status: install ok installed
Priority: optional
Section: admin
Installed-Size: 1476
Maintainer: Ubuntu Developers <email address hidden>
Architecture: amd64
Version: 0.5.14-8

Revision history for this message
Oliver Joos (oliver-joos) wrote :

There is a workaround to prevent the crash (side effects not clear to me):
https://bugs.launchpad.net/ubuntu/+source/laptop-mode-tools/+bug/779435/comments/4

Revision history for this message
dino99 (9d9) wrote :
Changed in hal (Ubuntu):
status: Confirmed → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.